{
"id": "GHSA-hjcp-jmpx-g3qm",
"aliases": [
"CVE-2026-64607"
],
"details": "HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported `Content-Encoding` header value in the response message. Please note this defect does not affect HttpClient based on the async i/o model.\n\nThis issue affects Apache HttpComponents Client: from 5.0-alpha1 through 5.6.2.",
"summary": "Apache HttpComponents Client: Connection Leak on Content-Encoding Decode Error Leads to Pool Exhaustion DoS",
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "5.0-alpha1"
},
{
"fixed": "5.6.3"
}
]
}
],
"package": {
"name": "org.apache.httpcomponents.client5:httpclient5",
"ecosystem": "Maven"
}
}
],
"modified": "2026-08-13T18:40:18Z",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
}
],
"published": "2026-07-31T12:30:30Z",
"references": [
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-64607",
"type": "ADVISORY"
},
{
"url": "https://github.com/apache/httpcomponents-client/commit/55733f4121f7ba26ddf04fe12739d9c15962cb94",
"type": "WEB"
},
{
"url": "https://github.com/apache/httpcomponents-client/commit/ebac9512f555c4a355cad3f59ef2db69b597cc97",
"type": "WEB"
},
{
"url": "https://github.com/apache/httpcomponents-client",
"type": "PACKAGE"
},
{
"url": "https://github.com/apache/httpcomponents-client/releases/tag/rel/v5.6.3",
"type": "WEB"
},
{
"url": "https://github.com/apache/httpcomponents-client/releases/tag/rel/v5.7-alpha1",
"type": "WEB"
},
{
"url": "https://lists.apache.org/thread/qqfzo3fqcdk4l5496vz95ppvl4ty511q",
"type": "WEB"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/08/13/5",
"type": "WEB"
}
],
"schema_version": "1.4.0",
"database_specific": {
"cwe_ids": [
"CWE-772"
],
"severity": "MODERATE",
"github_reviewed": true,
"nvd_published_at": "2026-07-31T11:17:11Z",
"github_reviewed_at": "2026-08-13T18:40:18Z"
}
}